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REMARKS 

This Application has been carefully reviewed in light of the Final Office Action mailed 
October 10, 2007. Claims 1-39 were pending in the Application. In the Final Office Action, 
Claims 1-39 were rejected. Claims 40-46 are added. Thus, Claims 1-46 remain pending in the 
Application. Applicants respectfully request reconsideration and favorable action in this case. 

In the Office Action, the following actions were taken or matters were raised: 

SECTION 102 REJECTIONS 

Claims 1,3-11,13, 14-17, 19-21, 23-29, 31-32, 34-37 and 39 were rejected under 35 
U.S.C. 102(e) as being anticipated by U.S. Patent No. 6978,385 issued to Cheston et al. 
(hereinafter "Cheston"). Applicants respectfully traverse this rejection. 

Under 35 U.S.C. § 102, a claim is anticipated only if each and every element as set forth 
in the claim is found in a single prior art reference. Verdegaal Bros. v. Union Oil Co. of 
California, 2 U.S.P.Q.2d 1051 (Fed. Cir. 1987); M.P.E.P. § 2131. In addition, "[t]he /'dentical 
invention must be shown in as complete detail as is contained in the . . . claims" and "[t]he 
elements must be arranged as required by the claim." Richardson v. Suzuki Motor Co., 9 
U.S.P.Q.2d 1913, 1920 (Fed. Cir. 1989); In re Bond, 15 U.S.P.Q.2d 1566 (Fed. Cir. 1990); 
M.P.E.P. §2131. 

Of the rejected claims, Claims 1, 14, 19, and 31 are independent. Claim 1 recites "a 
security module adapted to control access to a secure computer resource by a user via a client 
based on verification of a security credential provided by the user," and " verification data 
disposed on the client and accessible by the security module, the security module adapted to 
enable the user to recover the security credential based on a response received from the user 
associated with the verification data " (emphasis added). In the Office Action, the Examiner 
appears to assert that the primary password in Cheston corresponds to the "verification data" 
recited by Claim 1. (Office Action dated October 10, 2007, pages 2, 5 and 6). Applicants 
respectfully disagree. For example, Cheston appears to disclose a primary password stored in 
a client and used to permit access to the client by a user based on whether a password entered 
by the user matches the primary password. (Cheston, column 8, lines 31-35). Thus, if the 
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correct password is not entered, then the primary password of Cheston appears to be supplied 
by a remote server using an interrogative method. (Cheston, column 3, lines 14-20). Thus, the 
primary password of Cheston appears to simply authenticate a user to enable the user to 
access a client of Cheston. The primary password of Cheston does not appear to "enable the 
user to recover the security credential" as recited by Claim 1. In fact, Cheston appears to 
disclose that the interrogative password system and not the primary password enables recovery 
of the primary password. Moreover, Cheston appears to further disclose that the interrogative 
password system results in the remote server supplying the primary password to the BIOS of 
the client of Cheston as opposed to having verification data disposed on the client that would 
enable " the user to recover the security credential" as recited by Claim 1. Therefore, Applicants 
respectfully submit that Cheston does not appear to disclose or even suggest all the limitations 
of Claim 1. Accordingly, at least for these reasons, Applicants respectfully request that the 
rejection of Claim 1 be withdrawn. 

Moreover, Applicants respectfully submit that the Examiner has failed to establish a 
prima facie anticipation rejection of Claim 1. For example, in the Office Action, the Examiner 
appears to correspond the primary password of Cheston with both the "verification data" and 
the "security credential" recited by Claim 1, which is an improper claim construction. (Office 
Action dated October 10, 2007, pages 2, 5, and 6). Specifically, the Examiner states that the 
"client computer prompting the user for a primary password which is stored in the client... and a 
determination (verification) of whether or not the primary password the user was asked to enter 
into the client is valid." (Id. at 5). Therefore, by indicating that the primary password 
corresponds to two elements recited by Claim 1, the Examiner has failed to establish that " each 
and every element as set forth in" Claim 1 is found in Cheston in accordance with the MPEP. 
Moreover, the "verification data" recited by Claim 1 is used to enable a user to recover a 
credential. In contrast, the Examiner appears to use the term "verification" as verifying the 
accuracy of a password entered by a user. Therefore, Applicants respectfully submit that 
Cheston does not anticipate Claim 1. Accordingly, for at least these reasons, Applicants 
respectfully request that the rejection of Claim 1 be withdrawn. 

Independent Claim 14 recites a "means for controlling access to a secure computer 
resource associated with a client based on verification of a security credential provided by a 
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user of the client" and a "means for accessing verification data disposed on the client to enable 
the user to recover the security credential based on a response received from the user via the 
controlling means " (emphasis added). For at least the reasons discussed in connection with 
independent Claim 1, Applicants respectfully submit that Claim 14 is also patentable over the 
reference. 

Independent Claim 19 recites "receiving a request at a client to access a secure 
computer resource, a security credential required from the user to access the secure computer 
resource;" " presenting verification data disposed on the client to the user;" and " enabling the 
user to recover the security credential based on a response received from the user to the 
verification data " (emphasis added). For at least the reasons discussed in connection with 
independent Claim 1, Applicants respectfully submit that Claim 19 is also patentable over the 
reference. 

Independent Claim 31 recites "a collection module adapted to receive and store 
verification data associated with a user on a client " and " a recovery module adapted to enable 
the user to recover a security credential associated with accessing a secure computer resource 
via the client by verifying a user response to the verification data " (emphasis added). For at 
least the reasons discussed in connection with independent Claim 1, Applicants respectfully 
submit that Claim 31 is also patentable over the reference. 

Claims 3-11, 13, 15-17, 20-21, 23-29, 32, 34-37, and 39 depend respectively from 
independent Claims 1, 14, 19, and 31 and therefore are also patentable over the references at 
least because they incorporate the limitations of respective Claims 1, 14, 19, and 31 and also 
recite additional limitations that further distinguish the references. Accordingly, Applicants 
respectfully request that the rejections of Claims 1, 3-11, 13, 14-17, 19-21, 23-29, 31-32, 34- 
37 and 39 under 35 U.S.C. 103(a) be withdrawn. 

SECTION 103 REJECTIONS 

Claims 2, 12, 18, 22, 30, 33 and 38 were rejected under 35 U.S.C. 103(a) as being 
unpatentable over Cheston in view of U.S. Patent Publication No. 2004/0030932 issued to 
Juels et al. (hereinafter H Jive/s"). Applicants respectfully traverse this rejection. 
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Claims 2, 12, 18, 22, 30, 33 and 38 depend respectively from independent Claims 1, 
14, 19, and 31. As shown above, Claims 1, 14, 19, and 31 are patentable over Cheston. 
Therefore, for at least this reason, Claims 2, 12, 18, 22, 30, 33 and 38 which depend therefrom 
are also patentable over Cheston. Juels does not appear to remedy, nor does the Examiner 
rely on Juels to remedy, at least the deficiencies of Cheston indicated above. Accordingly, for 
at least this reason, Applicant respectfully requests that the rejection of Claims 2, 12, 18, 22, 
30, 33 and 38 be withdrawn. 

NEW CLAIMS 

Applicants add new Claims 40-46. New Claims 40-46 are fully supported by the 
specification as originally filed. Therefore, Applicants respectfully requests allowance of new 
Claims 40-46. 

INFORMATION DISCLOSURE STATEMENT 

Herewith this response, Applicants submit an Information Disclosure Statement 
(hereinafter "IDS") under 37 CFR 1.97(b). Applicants respectfully request consideration of the 
information submitted in the IDS. 
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CONCLUSION 



Applicants have made an earnest attempt to place this case in condition for immediate 
allowance. For the foregoing reasons and for other reasons clearly apparent, Applicants 
respectfully request reconsideration and full allowance of all pending claims. 

An RCE filing fee of $810.00 is believed due. With the presentation of new Claims 40- 
46, an excess claim fee of $560.00 pursuant to 37 C.F.R. § 1.16 is also believed due. The 
Director of Patents and Trademarks is hereby authorized to charge Deposit Account No. 08- 
2025 of Hewlett-Packard Company in the amount of $1,370.00 to satisfy the RCE filing fee. If, 
however, Applicants have miscalculated the fee due with this RCE, the Director is hereby 
authorized to charge any fees or credit any overpayment associated with this RCE to Deposit 
Account No. 08-2025 of Hewlett-Packard Company. If, however, Applicants have overlooked 
the need for any fee due with this Response, the Commissioner is hereby authorized to charge 
any fees or credit any overpayment associated with this Response to Deposit Account No. 08- 
2025 of Hewlett-Packard Company. 



Date: December 10, 2007 

Hewlett-Packard Company 
Intellectual Property Administration 
P. O. Box 272400 
Fort Collins, CO 80527-2400 
Tel. 970-898-7917 




Hope Shimabuku 
Reg. No. 57,072 
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